Overview
overview
10Static
static
3New WinRAR...ve.zip
windows7-x64
10New WinRAR...ve.zip
windows10-2004-x64
1data_Info_...me.xml
windows7-x64
3data_Info_...me.xml
windows10-2004-x64
1data_Info_...UI.dll
windows7-x64
1data_Info_...UI.dll
windows10-2004-x64
1data_Info_...UI.xml
windows7-x64
3data_Info_...UI.xml
windows10-2004-x64
1data_Info_...op.dll
windows7-x64
1data_Info_...op.dll
windows10-2004-x64
1python27.dll
windows7-x64
3python27.dll
windows10-2004-x64
3umyvvg
windows7-x64
1umyvvg
windows10-2004-x64
1vrrumug
windows7-x64
1vrrumug
windows10-2004-x64
1x64/031.phpt
windows7-x64
3x64/031.phpt
windows10-2004-x64
3x64/037.phpt
windows7-x64
3x64/037.phpt
windows10-2004-x64
3x64/bin/Mi...ad.dll
windows7-x64
1x64/bin/Mi...ad.dll
windows10-2004-x64
1x64/bin/bug77691.phpt
windows7-x64
3x64/bin/bug77691.phpt
windows10-2004-x64
3x64/bin/cu...e.phpt
windows7-x64
3x64/bin/cu...e.phpt
windows10-2004-x64
3x64/bin/fg...4.phpt
windows7-x64
3x64/bin/fg...4.phpt
windows10-2004-x64
3x64/bin/mb...1.phpt
windows7-x64
3x64/bin/mb...1.phpt
windows10-2004-x64
3x64/bin/pd...ode.js
windows7-x64
3x64/bin/pd...ode.js
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-01-2025 19:10
Static task
static1
Behavioral task
behavioral1
Sample
New WinRAR ZIP archive.zip
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
New WinRAR ZIP archive.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
data_Info_file/x64/AdonisUI.ClassicTheme.xml
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
data_Info_file/x64/AdonisUI.ClassicTheme.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
data_Info_file/x64/AdonisUI.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
data_Info_file/x64/AdonisUI.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
data_Info_file/x64/AdonisUI.xml
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
data_Info_file/x64/AdonisUI.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
data_Info_file/x64/SQLite.Interop.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
data_Info_file/x64/SQLite.Interop.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
python27.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
python27.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
umyvvg
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
umyvvg
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
vrrumug
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
vrrumug
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
x64/031.phpt
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
x64/031.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
x64/037.phpt
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
x64/037.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
x64/bin/Microsoft.VisualStudio.Setup.Download.dll
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
x64/bin/Microsoft.VisualStudio.Setup.Download.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
x64/bin/bug77691.phpt
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
x64/bin/bug77691.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
x64/bin/curlopt_private.phpt
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
x64/bin/curlopt_private.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
x64/bin/fgetcsv_variation14.phpt
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
x64/bin/fgetcsv_variation14.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
x64/bin/mb_output_handler_pattern-01.phpt
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
x64/bin/mb_output_handler_pattern-01.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
x64/bin/pdo_mysql_attr_errmode.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
x64/bin/pdo_mysql_attr_errmode.js
Resource
win10v2004-20241007-en
General
-
Target
x64/bin/curlopt_private.phpt
-
Size
548B
-
MD5
656a06ab08bb82b2ffb8324a9a581c88
-
SHA1
5ab0abd0048b33added5ec6ef512a40b5f269699
-
SHA256
3675503ae3ad8966f4865aaae930e22578b386a4f509d93834eedc1cda7da8de
-
SHA512
9990d914250a182225b155446e7d142b394f7d63947efe773faa7d242fa270cd81bd30fbdc0d8c533308ce1b31df5e28674990a3d095a1f9695ab11cae8dbf96
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2548 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2548 AcroRd32.exe 2548 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2876 2744 cmd.exe 32 PID 2744 wrote to memory of 2876 2744 cmd.exe 32 PID 2744 wrote to memory of 2876 2744 cmd.exe 32 PID 2876 wrote to memory of 2548 2876 rundll32.exe 33 PID 2876 wrote to memory of 2548 2876 rundll32.exe 33 PID 2876 wrote to memory of 2548 2876 rundll32.exe 33 PID 2876 wrote to memory of 2548 2876 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\x64\bin\curlopt_private.phpt1⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x64\bin\curlopt_private.phpt2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x64\bin\curlopt_private.phpt"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fd8033829cff6527259aa475119ddbd3
SHA18a2718b3c8644f1292062fee1fa6de3c30d05085
SHA256382b78fe391aa0c3ccba53615034cca1b55343c76d2d6e90ae818684c70aeddc
SHA512c49bc814249bcb36099c740d99365232685f14a5b0facffb90486d814918cad7d4590869a25d86de52bc23aac773b4602918dea52f031826085e84a6d25b3d29